Palo Alto Networks PSE-Strata-Pro-24 Practice Exam Questions & Answers

Segregating a network into unique BGP environments requires the ability to configure separate eBGP autonomous systems (AS) within the NGFW. Palo Alto Networks firewalls support advanced BGP features, including the ability to create and manage multiple autonomous systems.

Why 'It can be addressed by creating multiple eBGP autonomous systems' (Correct Answer B)?

PAN-OS supports the configuration of multiple eBGP AS environments. By creating unique eBGP AS numbers for different parts of the network, traffic can be segregated and routed separately. This feature is commonly used in multi-tenant environments or networks requiring logical separation for administrative or policy reasons.

Each eBGP AS can maintain its own routing policies, neighbors, and traffic segmentation.

This approach allows the NGFW to address the customer's need for segregated internal BGP environments.

Why not 'It cannot be addressed because PAN-OS does not support it' (Option A)?

This statement is incorrect because PAN-OS fully supports BGP, including eBGP, iBGP, and features like route reflectors, confederations, and autonomous systems.

Why not 'It can be addressed with BGP confederations' (Option C)?

While BGP confederations can logically group AS numbers within a single AS, they are generally used to simplify iBGP designs in very large-scale networks. They are not commonly used for segregating internal environments and are not required for the described use case.

Why not 'It cannot be addressed because BGP must be fully meshed internally to work' (Option D)?

Full mesh iBGP is only required in environments without route reflectors. The described scenario does not mention the need for iBGP full mesh; instead, it focuses on segregated environments, which can be achieved with eBGP.

Advanced WildFire is Palo Alto Networks' cloud-based malware analysis and prevention solution. It determines whether files are malicious by executing them in a sandbox environment and observing their behavior. To address the customer's concern about the file categorization, the systems engineer must provide evidence of the file's behavior. Here's the analysis of each option:

Option A: Review the threat logs for information to provide to the customer

Threat logs can provide a summary of events and verdicts for malicious files, but they do not include the detailed behavior analysis needed to convince the customer.

While reviewing the logs is helpful as a preliminary step, it does not provide the level of proof the customer needs.

This option is not sufficient on its own.

Option B: Use the WildFire Analysis Report in the log to show the customer the malicious actions the file took when it was detonated

WildFire generates an analysis report that includes details about the file's behavior during detonation in the sandbox, such as network activity, file modifications, process executions, and any indicators of compromise (IoCs).

This report provides concrete evidence to demonstrate why the file was flagged as malicious. It is the most accurate way to assure the customer that WildFire's decision was based on observed malicious actions.

This is the best option.

Option C: Open a TAG ticket for the customer and allow support engineers to determine the appropriate action

While opening a support ticket is a valid action for further analysis or appeal, it is not a direct way to assure the customer of the current WildFire verdict.

This option does not directly address the customer's request for immediate proof.

This option is not ideal.

Option D: Do nothing because the customer will realize Advanced WildFire is right

This approach is dismissive of the customer's concerns and does not provide any evidence to support WildFire's decision.

This option is inappropriate.

Palo Alto Networks documentation on WildFire

WildFire Analysis Reports

North-south traffic refers to the flow of data in and out of a network, typically between internal resources and the internet. To secure this type of traffic, Palo Alto Networks recommends specific CDSS subscriptions in addition to DNS Security:

A . SaaS Security

SaaS Security is designed for monitoring and securing SaaS application usage but is not essential for handling typical north-south traffic.

B . Advanced WildFire

Advanced WildFire provides cloud-based malware analysis and sandboxing to detect and block zero-day threats. It is a critical component for securing north-south traffic against advanced malware.

C . Enterprise DLP

Enterprise DLP focuses on data loss prevention, primarily for protecting sensitive data. While important, it is not a minimum recommendation for securing north-south traffic.

D . Advanced Threat Prevention

Advanced Threat Prevention (ATP) replaces traditional IPS and provides inline detection and prevention of evasive threats in north-south traffic. It is a crucial recommendation for protecting against sophisticated threats.

E . Advanced URL Filtering

Advanced URL Filtering prevents access to malicious or harmful URLs. It complements DNS Security to provide comprehensive web protection for north-south traffic.

Key Takeaways:

Advanced WildFire, Advanced Threat Prevention, and Advanced URL Filtering are minimum recommendations for NGFWs handling north-south traffic, alongside DNS Security.

SaaS Security and Enterprise DLP, while valuable, are not minimum requirements for this use case.

Palo Alto Networks NGFW Best Practices

Cloud-Delivered Security Services

A perimeter firewall is traditionally deployed at the boundary of a network to protect it from external threats. It provides a variety of protections, including blocking unauthorized access, inspecting traffic flows, and safeguarding sensitive resources. Here is how the options apply:

Option A (Correct): Perimeter firewalls provide network layer protection by filtering and inspecting traffic entering or leaving the network at the outer edge. This is one of their primary roles.

Option B: Power utilization is not a functional or architectural aspect of a firewall and is irrelevant when describing the purpose of a perimeter firewall.

Option C: Securing east-west traffic is more aligned with data center firewalls, which monitor lateral (east-west) movement of traffic within a virtualized or segmented environment. A perimeter firewall focuses on north-south traffic instead.

Option D (Correct): A perimeter firewall primarily secures north-south traffic, which refers to traffic entering and leaving the network. It ensures that inbound and outbound traffic adheres to security policies.

Option E (Correct): Perimeter firewalls play a critical role in guarding against external attacks, such as DDoS attacks, malicious IP traffic, and other unauthorized access attempts.

Palo Alto Networks Firewall Deployment Use Cases: https://docs.paloaltonetworks.com

Security Reference Architecture for North-South Traffic Control.

Prisma Access (Answer A):

Strata Cloud Manager (SCM) and Panorama provide centralized visibility and management for Prisma Access, Palo Alto Networks' cloud-delivered security platform for remote users and branch offices.

NGFW (Answer D):

Both SCM and Panorama are used to manage and monitor Palo Alto Networks Next-Generation Firewalls (NGFWs) deployed in on-premise, hybrid, or multi-cloud environments.

Prisma SD-WAN (Answer E):

SCM and Panorama integrate with Prisma SD-WAN to manage branch connectivity and security, ensuring seamless operation in an SD-WAN environment.

Why Not B:

Prisma Cloud is a distinct platform designed for cloud-native security and is not directly managed through Strata Cloud Manager or Panorama.

Why Not C:

Cortex XSIAM (Extended Security Intelligence and Automation Management) is part of the Cortex platform and is not managed by SCM or Panorama.

Reference from Palo Alto Networks Documentation:

Strata Cloud Manager Overview

Panorama Features and Benefits

The appropriate CDSS subscription to inspect and mitigate suspicious DNS traffic is Advanced DNS Security. Here's why:

Advanced DNS Security protects against DNS-based threats, including domain generation algorithms (DGA), DNS tunneling (often used for data exfiltration), and malicious domains used in attacks. It leverages machine learning to detect and block DNS traffic associated with command-and-control servers or other malicious activities. In this case, unusually high DNS traffic to an unfamiliar IP address is likely indicative of a DNS-based attack or malware activity, making this the most suitable service.

Option A: Advanced Threat Prevention (ATP) focuses on identifying and blocking sophisticated threats in network traffic, such as exploits and evasive malware. While it complements DNS Security, it does not specialize in analyzing DNS-specific traffic patterns.

Option B: Advanced WildFire focuses on detecting and preventing file-based threats, such as malware delivered via email attachments or web downloads. It does not provide specific protection for DNS-related anomalies.

Option C: Advanced URL Filtering is designed to prevent access to malicious or inappropriate websites based on their URLs. While DNS may be indirectly involved in resolving malicious websites, this service does not directly inspect DNS traffic patterns for threats.

Option D (Correct): Advanced DNS Security specifically addresses DNS-based threats. By enabling this service, the customer can detect and block DNS queries to malicious domains and investigate anomalous DNS behavior like the high traffic observed in this scenario.

How to Enable Advanced DNS Security:

Ensure the firewall has a valid Advanced DNS Security license.

Navigate to Objects > Security Profiles > Anti-Spyware.

Enable DNS Security under the 'DNS Signatures' section.

Apply the Anti-Spyware profile to the relevant Security Policy to enforce DNS Security.

Palo Alto Networks Advanced DNS Security Overview: https://www.paloaltonetworks.com/dns-security

Best Practices for DNS Security Configuration.

Device-ID is a feature in Palo Alto Networks firewalls that identifies devices based on their unique attributes (e.g., MAC addresses, device type, operating system). Device-ID can be used in several policy types to provide granular control. Here's how it applies to each option:

Option A: Security

Device-ID can be used in Security policies to enforce rules based on the device type or identity. For example, you can create policies that allow or block traffic for specific device types (e.g., IoT devices).

This is correct.

Option B: Decryption

Device-ID cannot be used in decryption policies. Decryption policies are based on traffic types, certificates, and other SSL/TLS attributes, not device attributes.

This is incorrect.

Option C: Policy-based forwarding (PBF)

Device-ID can be used in PBF policies to control the forwarding of traffic based on the identified device. For example, you can route traffic from certain device types through specific ISPs or VPN tunnels.

This is correct.

Option D: SD-WAN

SD-WAN policies use metrics such as path quality (e.g., latency, jitter) and application information for traffic steering. Device-ID is not a criterion used in SD-WAN policies.

This is incorrect.

Option E: Quality of Service (QoS)

Device-ID can be used in QoS policies to apply traffic shaping or bandwidth control for specific devices. For example, you can prioritize or limit bandwidth for traffic originating from IoT devices or specific endpoints.

This is correct.

Palo Alto Networks documentation on Device-ID